Re:Exploiting McDonald's APIs to hijack deliveries and order...
by move-on-by on Thursday December 19, 2024 @09:40PM
(#42467785)
I don’t know how popular this service is in India, but holy cow these abilities could easily be exploited for nefarious purposes:
* The ability to steal/hijack/redirect other people’s delivery orders through a specific sequence of carefully timed API calls.
* The ability to retrieve the details of any order.
Wait for a target to order something, redirect the delivery to yourself. Then take the order and deliver it yourself to the target. Access granted, and you’ve got a nice fall guy- the original delivery person. IDK, I’m not a criminal, but seems like it could go for more than $240 on the black market.
* The ability to steal/hijack/redirect other people’s delivery orders through a specific sequence of carefully timed API calls.
* The ability to retrieve the details of any order.
Wait for a target to order something, redirect the delivery to yourself. Then take the order and deliver it yourself to the target. Access granted, and you’ve got a nice fall guy- the original delivery person. IDK, I’m not a criminal, but seems like it could go for more than $240 on the black market.